What's Happening
NIST has announced an update to how the National Vulnerability Database (NVD) handles CVE enrichment. The driver is scale: vulnerability submissions grew by 263% between 2020 and 2025, making the old approach of enriching every CVE equally unsustainable.
Under the new model, NVD will prioritize enriching the vulnerabilities that matter most, specifically those appearing in CISA's Known Exploited Vulnerabilities (KEV) catalog and those affecting critical software. Lower-priority CVEs may receive less metadata, slower enrichment, or none at all.
This signals a broader industry shift away from static, count-based vulnerability management toward risk-based prioritization. The volume problem is also being accelerated by AI: models that can autonomously discover zero-days and rapidly develop exploits are expected to produce a significant influx of AI-discovered CVEs in the near term, compressing the window between "patch available" and "exploited in the wild" even further.
Why Should You Care
If your vulnerability management program leans on NVD-enriched CVSS scores as the primary signal for what to patch, those scores are becoming less reliable as a complete picture. NVD enrichment will now be uneven by design, meaning some CVEs will arrive with full metadata while others will not.
More importantly, this change reflects a truth the industry has been slow to act on: static CVSS scores do not tell you whether a vulnerability is actually reachable in your specific environment. A CVSS 9.8 that does not ship, is blocked at the network layer, or affects a code path no customer ever exercises is fundamentally different from a CVSS 7.0 that is publicly exposed and trivially exploitable.
The practical question is shifting from "What severity did NVD assign?" to "What is the actual risk of this vulnerability in our specific environment?" Teams that have not already made that transition will feel the NVD change more acutely.
How This Affects Fletch Labs
For Clients
Your Fletch Labs security assessment reports already reflect this direction. Every finding is assessed under two scoring frameworks:
-
PracticalRisk (Fletch Labs) uses an
Impact × Exploitability × Exposuremodel on a qualitative scale. The Exposure dimension explicitly captures whether the vulnerable code path is present and reachable in the built, deployed product. A finding that does not ship to production is scored accordingly, and will not inflate the headline risk rating. This is the model most directly aligned with how NIST is now asking the industry to think. - CVSS v3.1 Base is reported alongside PracticalRisk for alignment with industry standards, procurement requirements, and vendor disclosure processes. Where CVSS Base scores do not account for deployment exclusions, we document environmental considerations or note "N/A to production" explicitly.
The headline qualitative rating in your report is not derived by averaging or summing scores. It reflects judgment on what is actually reachable in the assessed build, accounting for network controls, configuration, and deployment context. Findings with no reachable surface do not raise the overall risk level.
In short: the NVD change does not invalidate your reports. It validates the approach already baked into them.